From 2c978ced191ecbd350b25cea48cccb02595a8f6c Mon Sep 17 00:00:00 2001 From: Liz Rea Date: Thu, 28 Jul 2011 16:14:05 -0500 Subject: [PATCH] Bug 6641 -- Specially crafted URL can allow unauthorized download of MARC files from staff client Content-Type: text/plain; charset="utf-8" Making sure permissions are checked on download of MARC files from staff client --- catalogue/export.pl | 12 +++++++++++- 1 files changed, 11 insertions(+), 1 deletions(-) diff --git a/catalogue/export.pl b/catalogue/export.pl index 9bd49de..3efdb21 100755 --- a/catalogue/export.pl +++ b/catalogue/export.pl @@ -8,9 +8,19 @@ use C4::Auth; use C4::Output; use C4::Biblio; use CGI; -use C4::Auth; + + my $query = new CGI; +my ( $template, $loggedinuser, $cookie ) = get_template_and_user({ + template_name => "tools/export.tt", + query => $query, + type => "intranet", + authnotrequired => 0, + flagsrequired => { tools => 'export_catalog' }, + debug => 1, + }); + my $op=$query->param("op"); my $format=$query->param("format"); if ($op eq "export") { -- 1.7.2.5